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AMENDMENTS TO THE CLAIMS 

This listing of claims will replace all prior versions, and listings, of claims in the application: 

Claim 1 (Currently amended): A method of identifying service abuse, comprising: 
receiving an event requesting a service; 
creating an event identification associated with the event; 

selecting a table entry from a plurality of table entries in a screening table as a selected 

table entry; 

incrementing a first count value associated with [[of]] a first table entry of [[a]] the 
plurality of table entries in [[a]] the screening table in response to the event identification matching 
an event identification associated with the screening first table entry; 

decrementing a second count value associated with [[of a]] the_selected table entry of the 
plurality of table entries in response to the event identification failing to match an event 
identification associated with the selected table entry; 

replacing the selected table entry with the event identification associated with the 
received event in response to the second count [[of]] value of the selected entry equaling [[zero]] a 
predetermined value ; and 

determining a metric value for the event from the screening table, the metric value 
indicating that the event is an abusive request. 

Claim 2 (Original): The method of claim 1, wherein the event identification corresponds 
with the identity of a user. 

Claim 3 (Original): The method of claim 2, wherein the event identification includes an IP 
address. 

Claim 4 (Original): The method of claim 2, wherein the event identification includes a user 
identification. 
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Claim 5 (Original): The method of claim 1, wherein the event identification corresponds 
with a content value included in the event. 

Claim 6 (Original): The method of claim 5, wherein the content value includes at least a 
portion of a message. 

Claim 7 (Original): The method of claim 5, wherein the content value includes at least a 
portion of a URL. 

Claim 8 (Original): The method of claim 1, further including: selecting a second table entry 
as a new selected table entry in response to receiving the event. 

Claim 9 (Currently amended): The method of claim 1, further including: 

selecting a second table entry as a new selected table entry in response to the event 
identification failing to match an event identification associated with the selected-table entry. 

Claim 10 (Original): The method of claim 1, further including disregarding the event in 
response to the metric value crossing a threshold value. 

Claim 11 (Original): The method of claim 1, further including terminating a connection 
used to receive the event in response to the metric value crossing a threshold value. 

Claim 12 (Original): The method of claim 1, further including returning an error message in 
response to the event in response to the metric value crossing a threshold value. 

Claim 13 (Original): The method of claim 1, further including: 

determining an average metric value from the metric value and a set of previous metric 

values; and 

disregarding the event in response to the average metric value crossing a threshold value. 
Claim 14 (Original): The method of claim 1, wherein determining a metric value comprises: 
determining a first sub-metric value from the screening table; 
determining a second sub-metric value from a second screening table; 
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determining the metric value from a weighted combination of the first and second sub- 
metric values. 

Claim 15 (Original): A system for identifying service abuse, comprising: 

a plurality of server computers each adapted to receive an event and to create an event 
packet in response to the event; 

a cluster host adapted to receive a plurality of event packets from at least a portion of the 
plurality of server computers and to update a master screening table in response to the plurality of 
event packets; and 

wherein the cluster host is further adapted to communicate a local screening table 
comprising at least a portion of the master screening table to each of the plurality of server 
computers, and each of the plurality of server computers is adapted to disregard an event matching a 
portion of the local screening table. 

Claim 16 (Original): The system of claim 15, wherein the local screening table is a copy of 
the master screening table. 

Claim 17 (Currently amended): The system of claim 15, wherein each event packet includes 
an event identification associated with [[a]] an event. 

Claim 18 (Original): The system of claim 17, wherein the event identification corresponds 
with the identity of a user. 

Claim 19 (Original): The system of claim 18, wherein the event identification includes an IP 
address. 

Claim 20 (Original): The system of claim 18, wherein the event identification includes a 
user identification. 

Claim 21 (Original): The system of claim 17, wherein the event identification corresponds 
with a content value included in the event. 
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Claim 22 (Original): The system of claim 21 wherein the content value includes at least a 
portion of a message. 

Claim 23 (Original): The system of claim 21, wherein the content value includes at least a 
portion of a URL. 

Claim 24 (Original): The system of claim 21, wherein the content value is a hash of the 
content value included in the event. 

Claim 25 (Original): The system of claim 15, wherein the cluster host is further adapted to 
determine a metric value for an entry of the master screening table, the metric indicating that the 
entry of the master screening table corresponds to an abusive request. 

Claim 26 (Original): The system of claim 25, wherein the cluster host is further adapted to 
set a block value associated with the entry in response to the metric value. 

Claim 27 (Original): The system of claim 25, wherein the cluster host is adapted to 
determine an average metric value from the metric value and a set of previous metric values and to 
set a block value associated with the entry in response to the average metric value. 

Claim 28 (Original): The system of claim 15, wherein the cluster host is adapted to 
determine a first sub-metric value from the entry, to determine a second sub-metric value from an 
entry of a second master screening table, and to determine the metric value from a weighted 
combination of the first and second sub-metric values. 

Claim 29 (New): The method of claim 1, wherein the predetermined value is zero. 

Claim 30 (New): A computer readable medium encoded with program code for: 

receiving an event requesting a service; 

creating an event identification associated with the event; 

selecting a table entry from a plurality of table entries in a screening table as a selected 

table entry; 
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incrementing a first count value associated with a first table entry of the plurality of table 
entries in the screening table in response to the event identification matching an event identification 
associated with the first table entry; 

decrementing a second count value associated with the selected table entry of the 
plurality of table entries in response to the event identification failing to match an event 
identification associated with the selected table entry; 

replacing the selected table entry with the event identification associated with the 
received event in response to the second count value equaling a predetermined value; and 

determining a metric value for the event from the screening table, the metric value 
indicating that the event is an abusive request. 

Claim 31 (New): The computer readable medium of claim 30, wherein the event 
identification corresponds with the identity of a user. 

Claim 32 (New): The computer readable medium of claim 30, further comprising program 
code for selecting a second table entry as a new selected table entry in response to receiving the 
event. 

Claim 33 (New): The computer readable medium of claim 30, further comprising program 
code for selecting a second table entry as a new selected table entry in response to the event 
identification failing to match an event identification associated with the selected table entry. 

Claim 34 (New): The computer readable medium of claim 30, further comprising program 
code for disregarding the event in response to the metric value crossing a threshold value. 

Claim 35 (New): The computer readable medium of claim 30, further comprising program 
code for terminating a connection used to receive the event in response to the metric value crossing a 
threshold value. 

Claim 36 (New): The computer readable medium of claim 30, further comprising program 
code for: 
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determining an average metric value from the metric value and a set of previous metric 

values; and 

disregarding the event in response to the average metric value crossing a threshold value. 

Claim 37 (New): The computer readable medium of claim 30, further comprising program 
code for: 

determining a first sub-metric value from the screening table; 

determining a second sub-metric value from a second screening table; 

determining the metric value from a weighted combination of the first and second sub- 
metric values. 

Claim 38 (New): A server comprising: 
a processor; 

an input/output interface; and 
the computer readable medium of claim 30. 
Claim 39 (New): A server comprising: 
a processor; 

an input/output interface; and 
the computer readable medium of claim 31. 
Claim 40 (New): A server comprising: 
a processor; 

an input/output interface; and 

the computer readable medium of claim 32. 
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Claim 41 (New): A server comprising: 
a processor; 

an input/output interface; and 
the computer readable medium of claim 33. 
Claim 42 (New): A server comprising: 
a processor; 

an input/output interface; and 
the computer readable medium of claim 34. 
Claim 43 (New): A server comprising: 
a processor; 

an input/output interface; and 
the computer readable medium of claim 35. 
Claim 44 (New): A server comprising: 
a processor; 

an input/output interface; and 
the computer readable medium of claim 36. 
Claim 45 (New): A server comprising: 
a processor; 

an input/output interface; and 

the computer readable medium of claim 37. 
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